Commit 796f0d39 authored Aug 11, 2020 by Peilin Ye Committed by Greg Kroah-Hartman Oct 30, 2020

ipvs: Fix uninit-value in do_ip_vs_set_ctl()



[ Upstream commit c5a8a8498eed1c164afc94f50a939c1a10abf8ad ]

do_ip_vs_set_ctl() is referencing uninitialized stack value when `len` is
zero. Fix it.

Reported-by:  <syzbot+23b5f9e7caf61d9a3898@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?id=46ebfb92a8a812621a001ef04d90dfa459520fe2


Suggested-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Reviewed-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent d4411729

net/netfilter/ipvs/ip_vs_ctl.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -2393,6 +2393,10 @@ do_ip_vs_set_ctl(struct sock sk, int cmd, void __user user, unsigned int len)
		/* Set timeout values for (tcp tcpfin udp) */
		ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);
		goto out_unlock;
		} else if (!len) {
		/* No more commands with len == 0 below */
		ret = -EINVAL;
		goto out_unlock;
		}

		usvc_compat = (struct ip_vs_service_user *)arg;
		@@ -2469,9 +2473,6 @@ do_ip_vs_set_ctl(struct sock sk, int cmd, void __user user, unsigned int len)
		break;
		case IP_VS_SO_SET_DELDEST:
		ret = ip_vs_del_dest(svc, &udest);
		break;
		default:
		ret = -EINVAL;
		}

		out_unlock: